An Introduction to VolUtility
Basil Alawi S.Taher has posted a nice overview of how to start using VolUtility – a web frontend for Volatility framew…
Volatility Workbench Beta
PassMark Software has released a beta version of Volatility Workbench – a graphical user interface (GUI) for the Volat…
Mac FS Events Parser for Autopsy
Mark McKinnon has written a plugin that will export the /.fseventsd directory to the temp folder and will then call an execu…
Autopsy 4.4.0 is out!
The new version of our favorite open source forensic tool – Autopsy, – has been released. New triage features. M…
Digital Forensics and Incident Response
Another DFIR book has been announced by Packt Publishing. It’s “Digital Forensics and Incident Response” b…
Windows Prefetch Carver
Adam Witt has presented a fresh Python script. It’s called Windows Prefetch Carver and, as you already understood, can…
Using Binsnitch.py to Detect Files Touched by Malware
Daan Raman from NVISO Labs has published a blog post about their new tool – binsnitch.py. You can use this tool to det…
SANS How To’s: SRUM-DUMP (System Resource Utilization Monitor) Tool
In this video Mark Baggett will show you how you can use a tool named SRUM-DUMP to capture critical DFIR (Digital Forensics …
Chainsaw of Custody: Manipulating forensic evidence the easy way
Wolfgang Ettlinger from SEC Consult Vulnerability Lab has published an interesting research on how to manipulate forensic ev…
Rapid Provisioning of a Malware Analysis Environment
Adam Kramer has published a post in SANS DFIR blog about ‘rapid_env’. This is an open source tool he developed, …
